erikdubbelboer

# collision inputs taken from https://www.mscs.dal.ca/~selinger/md5collision/
# As you can see they produce the same MD5 hash
$ echo -n 'd131dd02c5e6eec4693d9a0698aff95c2fcab58712467eab4004583eb8fb7f8955ad340609f4b30283e488832571415a085125e8f7cdc99fd91dbdf280373c5bd8823e3156348f5bae6dacd436c919c6dd53e2b487da03fd02396306d248cda0e99f33420f577ee8ce54b67080a80d1ec69821bcb6a8839396f9652b6ff72a70' | xxd -r -p | md5  
79054025255fb1a26e4bc422aef54eb4
$ echo -n 'd131dd02c5e6eec4693d9a0698aff95c2fcab50712467eab4004583eb8fb7f8955ad340609f4b30283e4888325f1415a085125e8f7cdc99fd91dbd7280373c5bd8823e3156348f5bae6dacd436c919c6dd53e23487da03fd02396306d248cda0e99f33420f577ee8ce54b67080280d1ec69821bcb6a8839396f965ab6ff72a70' | xxd -r -p | md5  
79054025255fb1a26e4bc422aef54eb4

# Now add 01 to the end of both of them.
# The hash will be different from above but they will still produce a collision.
$ echo -n 'd131dd02c5e6eec4693d9a0698aff95c2fcab58712467eab4004583eb8fb7f8955ad340609f4b30283e488832571415a085125e8f7cdc99fd91dbdf2

erikdubbelboer

package gziphandler

import (
	"compress/gzip"
	"log"
	"net/http"
	"strings"
	"sync"
)

erikdubbelboer

google.com,172.217.17.46
youtube.com,172.217.19.206
baidu.com,39.156.69.79
tmall.com,140.205.94.193
sohu.com,221.179.177.36
qq.com,111.161.64.40
facebook.com,157.240.201.35
taobao.com,140.205.220.96
login.tmall.com,47.246.48.233
wikipedia.org,91.198.174.192

erikdubbelboer

Here are the potential issues found in the codebase:

1. Ignored Sync Error in Logging (cmd/signaling/main.go)

   • File: cmd/signaling/main.go
   • Issue: logger.Sync() error is ignored with // nolint:errcheck. In production, this could lead to lost log entries during shutdown.
   • Fix: Handle the error or log it.

2. Panic in Test Proxy (cmd/testproxy/main.go)

   • File: cmd/testproxy/main.go

• Issue: HTTP handlers use panic(err) which crashes the server on errors. Not suitable for production.

erikdubbelboer

Okay, this is a large codebase. Here's a breakdown of potential issues and bugs, focusing on areas that stand out:

cmd/signaling/main.go

• Error Handling: The error handling in main.go is a bit aggressive. logger.Panic will terminate the application, which might not be desirable in a production environment. Consider using logger.Fatal or logging the error and attempting to recover.
• Random Seed: While the code seeds the random number generator, seeding with time.Now().UnixNano() isn't ideal for security-sensitive applications. If the generated random numbers are used for any kind of security purpose (unlikely in this code, but worth noting), a more secure random source should be used.
• Potential resource leak: I can't see a close DB connection anywhere. While the server has defer logger.Sync(), I can't see the DB connection to postgres closed correctly. While the cloudflare credentials client does have a defer cancel(), I can't see any defer cancel() for the DB connec

erikdubbelboer

Defold games on Poki

https://poki.com/en/g/1010-color-match
https://poki.com/en/g/block-puzzle-classic
https://poki.com/en/g/blocky-blast-puzzle
https://poki.com/en/g/blocky-universe
https://poki.com/en/g/bouncy-catapult
https://poki.com/en/g/boxrob
https://poki.com/en/g/boxrob-2
https://poki.com/en/g/boxrob-3

erikdubbelboer

export function loadPokiSDK() {
    const getParameterByName = (name) => {
        const match = RegExp(`[?&]${name}=([^&]*)`).exec(window.location.search);
        return match && decodeURIComponent(match[1].replace(/\+/g, ' '));
    };

    const queue = [];
    const isLocalhost = window.location.hostname === 'localhost';

    window.PokiSDK = new Proxy(

erikdubbelboer

package main

import (
	"bytes"
	"fmt"
	"net"
	"runtime"
	"sync"
	"sync/atomic"
	"time"

erikdubbelboer

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"fmt"

erikdubbelboer

package main

import (
	"fmt"
	"runtime"
	"sync"
	"sync/atomic"
	"time"
)